Remove ManticoreControl object [#180] (#4)

* Remove ManticoreControl object
* Some changes were brought in from dev-symbolicate-api
* Add Manticore.terminate()
* Add State.abandon()
* Update sample scripts
* Remove ctl from README
* Fix tests
* Bring in changes from dev-symbolicate-api
* Lower-case wildcard
* string -> cstring
* abandon() docstring
* Rename "name" to "label"
* Remove obsolete comment
* Make NUL a possible value for the last byte of a cstring
* Fix AbandonState and add example binary&script
* name -> label in tests, manticore.py
* Ignore .DS_Store
* Update symbolicate_buffer docstring

examples/script/guide_exec.py

@@ -22,9 +22,9 @@ if __name__ == '__main__':
     # Ensure that we ignore all possible branches to libc
     # This hook returns False if we should abandon exploration
     # or True to continue
-    def fork_hook(new_pc):
+    def fork_hook(ctx, state):
         _from, _to = lib.start, lib.start + lib.size
-        return not (_from <= new_pc < _to)
+        return not (_from <= state.cpu.PC < _to)
     m.add_fork_hook(fork_hook)
 
     # Start path exploration. start() returns when Manticore

examples/script/lads-baby-re.py

@@ -11,7 +11,7 @@ if __name__ == '__main__':
     path = sys.argv[1]
     m = Manticore(path)
 
-    def myhook(ctx, state, ctl):
+    def myhook(ctx, state):
         flag = ''
         cpu = state.cpu
         arraytop = cpu.R11
@@ -22,7 +22,7 @@ if __name__ == '__main__':
             concrete_input = state.solve_one(symbolic_input)
             flag += chr(concrete_input & 0xff)
         print 'flag is:', flag
-        ctl.exit()
+        m.terminate()
 
     m.add_hook(0x109f0, myhook)
 

examples/script/run_callback.py

@@ -21,12 +21,12 @@ if __name__ == '__main__':
     m = Manticore(None, path, args)
 
     # Trigger an event when PC reaches a certain value
-    def reached_goal(state):
+    def reached_goal(ctx, state):
         cpu = state.cpu
 
-        assert cpu.pc == 0x10858
+        assert cpu.PC == 0x10858
 
-        instruction = cpu.read(cpu.pc, 4)
+        instruction = cpu.read(cpu.PC, 4)
         print "Execution goal reached."
         print "Instruction bytes: {:08x}".format(cpu.pc)
 

examples/script/state_explore.c

@@ -0,0 +1,56 @@
+#include <stdio.h>
+
+/**
+ * Example code for the state abandon example in the Manticore script corpus.
+ *
+ * # Compile binary
+ * $ gcc -m32 -static -g state_explore.c -o state_explore
+ *
+ * # Pull out the address of the branch we want to ignore
+ * $ ADDRESS=0x$(objdump -S state_explore | grep -A 1 'value == 0x41' |
+ *                 tail -n 1 | sed 's|^\s*||g' | cut -f1 -d:)
+ *
+ * # Run the analysis
+ * $ python state_explore.py state_explore $ADDRESS
+ */
+int
+main(int argc, char *argv[])
+{
+    int value;
+
+    read(0, &value, sizeof value);
+
+    if ((value & 0xff) != 0) {
+        if (value >= 0x40) {
+            write(1, "1", 1);
+            if (value == 0x41) {
+                write(1, "a", 1);
+            } else if (value == 0x42) {
+                write(1, "b", 1);
+            } else if (value == 0x43) {
+                write(1, "c", 1);
+            } else if (value == 0x44) {
+                write(1, "d", 1);
+            } else {
+                write(1, "e", 1);
+            }
+        } else {
+            write(1, "2", 1);
+        }
+    } else if ((value & 0xff00) != 0) {
+        if (value > 0x1000) {
+            write(1, "3", 1);
+        } else {
+            write(1, "4", 1);
+        }
+    } else if ((value & 0xff0000) != 0) {
+        if (value > 0xf0000) {
+            write(1, "5", 1);
+        } else {
+            write(1, "6", 1);
+        }
+    }
+    write(1, "\n", 2);
+
+    return 0;
+}

examples/script/state_explore.py

@@ -0,0 +1,22 @@
+
+import sys
+from manticore import Manticore
+
+if __name__ == '__main__':
+    if len(sys.argv) < 3:
+        sys.stderr.write("Usage: %s [binary] [address]\n"%(sys.argv[0],))
+        sys.exit(2)
+
+    m = Manticore(sys.argv[1])
+
+    # Set to the address of the conditonal checking for the first complex branch
+    to_abandon = int(sys.argv[2], 0)
+
+    def explore(ctx, state):
+        print "Abandoning state at PC: ", hex(state.cpu.PC)
+        state.abandon()
+
+    print "Adding hook to: ", hex(to_abandon)
+    m.add_hook(to_abandon, explore)
+
+    m.start()

examples/script/sym.py

@@ -29,7 +29,7 @@ if __name__ == '__main__':
     else:
         target = (0x400a83, 'EBX')
 
-    def entered_func(state):
+    def entered_func(ctx, state):
         '''For ARM, Make R4 symbolic at 0x1082c, as r4 is used in a branch right
            after.
         '''